CVE-2026-49131 in OPNsense
Summary
by MITRE • 08/04/2026
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized description value is persisted and later rendered through the default cell formatter in opnsense_bootgrid.js, which assigns raw cell content to innerHTML, causing injected scripts to execute in the browser of any authenticated user who views the Firewall Rules page, enabling session hijacking or credential theft.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability resides within OPNsense firewall software version 26.1.8 and earlier, representing a critical stored cross-site scripting flaw that poses significant security risks to network administrators. The issue stems from insufficient input validation and sanitization mechanisms within the firewall rule management functionality, specifically targeting the description field of firewall rules. Attackers with legitimate firewall rule management privileges can exploit this weakness by crafting malicious HTML or JavaScript payloads and embedding them within the rule description field through the filter API endpoint.
The technical execution of this vulnerability occurs through a chain of insecure data handling processes that begin with user input acceptance and culminate in improper output rendering. When an authenticated attacker submits a malicious payload through the firewall rule description field, the system persists this unsanitized content without proper validation or sanitization. The vulnerable code path involves the opnsense_bootgrid.js library which employs a default cell formatter to render table data on the Firewall Rules page. This formatter directly assigns the raw, unprocessed cell content to the innerHTML property of HTML elements, creating an environment where injected scripts execute immediately upon page rendering without any sanitization or escaping mechanisms.
The operational impact of this vulnerability extends beyond simple script execution, as it enables sophisticated attack vectors that can compromise entire administrative sessions. Any authenticated user who views the Firewall Rules page becomes a potential victim of this stored XSS attack, making the threat particularly dangerous in multi-user environments where multiple administrators might access the same management interface. The execution of malicious scripts in the browser context allows attackers to perform session hijacking operations, steal authentication cookies, capture keystrokes, or even inject additional malicious code that could escalate privileges within the firewall management system. This vulnerability essentially transforms legitimate administrative access into a potential attack platform for lateral movement and persistent access.
This vulnerability maps directly to CWE-79, which specifically addresses cross-site scripting flaws in web applications, and aligns with ATT&CK technique T1566.002 for credential access through phishing attacks. The attack surface is particularly concerning given that the vulnerability requires only authentication privileges rather than elevated system access, making it accessible to users who have legitimate administrative duties but could be compromised or coerced into malicious activity. Organizations using OPNsense versions prior to 26.1.9 face significant risk of unauthorized access and potential network compromise through this vector.
The recommended mitigation strategy involves upgrading to OPNsense version 26.1.9 or later, which implements proper input sanitization and output escaping mechanisms for firewall rule descriptions. System administrators should also consider implementing additional security controls such as web application firewalls that can detect and block suspicious payloads in API endpoints, though this represents a secondary defense measure. Regular security audits of administrative interfaces should be conducted to identify similar input handling vulnerabilities, and organizations should maintain strict access controls with principle of least privilege enforcement. Additionally, monitoring for unusual rule creation patterns or modifications could serve as an early detection mechanism for potential exploitation attempts.